How This Briefing Works
This report opens with key findings, then maps the gaps between what Factors.ai discloses and what BLACKOUT observed at runtime. From there: what it means for your organization, what to do about it, and the detection data and evidence underneath.
Key Findings
Pre-Consent Activity
Factors.ai was observed loading and executing before user consent was obtained on 26% of sites where it was detected.
Claims vs. Observed Behavior
pending
“Requires claims extraction via CDT”
Live website analysis pending
What This Means For You
What To Do About It
Role-specific actions based on observed behavior
If You Use Factors.ai
- →Audit tag manager deployment for dynamic script loading and third-party calls
- →Review DPA for clarity on identity graph providers and data sharing arrangements
- →Implement consent gate to prevent identification of EU/UK visitors without explicit opt-in
If You're Evaluating Factors.ai
- →Server-side identification to reduce client-side fingerprinting footprint
- →First-party identity resolution using owned data sources only
- →Alternative ABM platforms with transparent matching methodologies
Negotiation Leverage
- →Demand exhaustive list of identity data providers and explicit controls over downstream data sharing
- →Request contractual prohibition on using your visitor data to enrich Factors' identity graph for other customers
- →Negotiate tag manager deployment restrictions requiring approval for new tracking capabilities or third-party integrations
Runtime Detections
BLACKOUT observed this vendor's JavaScript executing in a live browser and classified each hostile behavior using our BTI-C (Behavioral Threat Intelligence — Capability) taxonomy. These are not theoretical risks — each code below was triggered by something we watched this vendor's code actually do.
Keystroke/mouse tracking
Impact: Fingerprints visitors through interaction patterns, device characteristics, and engagement signals to enable cross-session identification
Identity stitching
Impact: Synchronizes visitor identity across domains and sessions through third-party identity graph integrations
Ignoring CMP signals
PII deanonymization
Container/loader (neutral)
Impact: Injects via GTM to bypass security review and dynamically load additional tracking capabilities without deployment visibility
IOC Manifest
Indicators of compromise across 5 categories. Use for detection rules, CSP policies, or Pi-hole blocklists.
Ecosystem & Supply Chain
Evidence Artifacts
Artifacts collected during analysis, available with evidence-tier access.
Complete network capture with all requests and responses
15 detection signatures across scripts, domains, cookies, and network endpoints